1

A networking newbie here. I setup an OpenVPN server in my home network so that I can use public Wi-Fi to first connect to my home network, and then use the Internet with some degree of security. I followed this tutorial to set it up: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-14-04. As far as I can tell, it's a very simple tunneling type OpenVPN setup. When working normal, I can access the Internet through this OpenVPN server, as well as connect to servers in my home network.

However I noticed a problem. My home IPv4 network range is 10.0.1.0/24, which is the default that came with my Mac AirPort Extreme router. When I go to a friend's house, or another public place whose router also uses the 10.0.1.0/24 IPv4 range, I can connect to my home network, but I can't access anything there. The reason is obvious: the local network I am at uses the same range and default gateway as my home setup.

I could change my network range, but then I would encounter a similar problem every time someone's local IPv4 network range was the same.

My question is: what sort of setup would I need to avoid this problem? Is this the reason to use a TAP setup rather then TUN? I'm more looking for a place to get started. Here's my server config:

/etc/openvpn/server.conf

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
dh dh2048.pem

server 10.8.0.0 255.255.255.0    # IP range for connecting users
ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.0.1.13" # My local DNS server
push "dhcp-option DNS 10.0.1.1"  # My home router DNS
push "dhcp-option DNS 8.8.8.8"   # Google public DNS

keepalive 10 120
comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log
verb 3

**** EDIT 1 ****

I found these resources:

https://openvpn.net/index.php/open-source/documentation/howto.html#numbering

https://serverfault.com/questions/21399/how-do-you-avoid-network-conflict-with-vpn-internal-networks

Is there really no way around this problem except for choosing a less-used private IPv4 subnet?

1
  • 1
    There really isn't. Avoid defaults like the plague - there's a LOT of private address space, and vast ranges of it are virtually unused. Use one, picked carefully, and you are very unlikely to have overlap issues. 10.137.56.0/24 for instance. – Ecnerwal Sep 12 '15 at 2:48
1

As @Ecnerwal said, you can't avoid the problem - only mitigate it - although there are some tricks to make the likelyhood of collission MUCH smaller.

You could use 172.31.x.x (people rarely seem to realise 172.16-32.x.x is reserved in the same way that 192.168.x.x and 10.x.x.x is and thus virtually never used), or - if you want to slightly break standards, 100.64.0.x
100.64.0.x should not be used in home networks as its "Carrier Grade NAT". Since you are encapsulating the endpoints you can probably get away with breaking the rules !

When specifying your range, you probably want to specify the smallest range you can - a /30 subnet (ie 4 IP addresses in the middle of the range) is a lot less likely to interfere with specific machines behind nat, and should play nice in practice because its a very specific route.

Of-course, another solution would be to shift your tunnel to IPV6.

1
  • Thank you guys for your responses! I'll take that into account. – Scott Crooks Sep 13 '15 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.